Security and privacy

Tenant isolation, roles, payments, and where public trust pages live.

Trust·All·Updated 2026-09-28·Open in console

agamnos isolates each property tenant. Staff and APIs are scoped by organization, property, and role—not a shared hotel-wide password.

Front desk sees hotel-today till on Operations home. Insights needs report:view. Finance needs finance:view. The audit log needs audit:view.

Card data stays with Razorpay or Stripe (or Agamnos Pay / Stripe Connect). The PMS stores payment references and folio lines, not PANs.

AI features, when enabled, stay property-scoped, redact sensitive fields, and require human confirm for irreversible actions.

Public trust pages: /security (controls and posture) and /privacy (what we process and hotel control). Formal SOC 2 / ISO certifications and DPAs follow the enterprise roadmap.

How to

  1. Owners: set Card payments under Property settings—use the hotel’s own keys or Agamnos Pay / Connect; never paste live secrets into Help or chat.
  2. Managers: assign roles so agents can run the desk without Finance if that is your policy.
  3. Everyone: open /security and /privacy for the public overview; use this article for day-to-day console questions.

Technical

  • Staff APIs: Authorization: Bearer <JWT>. Guards enforce permissions (for example payment:process, report:view, front-desk). Public routes are explicitly marked—booking, health, auth login/register/refresh, payment webhooks/confirm/config.
  • Webhooks verify processor signatures before updating folios. Do not share webhook secrets or RASNOS_FOLIO_API_KEY outside ops.
  • OpenAPI at /api/docs documents the surface; treat demo Hotel Agni credentials as training only.

FAQ

Who can see guest and money data?
Depends on role. Front desk operates stays and sees till. Finance needs finance:view. Housekeeping and technicians see their queues, not the full ledger.
Where do card numbers live?
With the payment processor. agamnos records that a payment was captured and how much posted to the folio.
Is demo Hotel Agni private?
Demo accounts are for training (Password123!). Do not enter real guest card details on the demo property.
Where are the public trust pages?
/security and /privacy. Linked from the marketing site and Help footer.
Where do integrators start?
Help → Agamnos API for base URL, JWT, public booking, and webhooks. OpenAPI at /api/docs on the API host.

See also: Getting started · Agamnos Pay · Agamnos API · Product suite · FAQ

All topics← Audit log